/*      */ package com.zimbra.cs.account.accesscontrol;
/*      */ 
/*      */ import com.google.common.cache.Cache;
/*      */ import com.google.common.cache.CacheBuilder;
/*      */ import com.google.common.collect.Sets;
/*      */ import com.zimbra.common.account.Key.CosBy;
/*      */ import com.zimbra.common.account.Key.DomainBy;
/*      */ import com.zimbra.common.localconfig.KnownKey;
/*      */ import com.zimbra.common.localconfig.LC;
/*      */ import com.zimbra.common.service.ServiceException;
/*      */ import com.zimbra.common.soap.Element;
/*      */ import com.zimbra.common.util.L10nUtil;
/*      */ import com.zimbra.common.util.Log;
/*      */ import com.zimbra.common.util.ZimbraLog;
/*      */ import com.zimbra.cs.account.AccessManager;
/*      */ import com.zimbra.cs.account.AccessManager.ViaGrant;
/*      */ import com.zimbra.cs.account.Account;
/*      */ import com.zimbra.cs.account.AccountServiceException;
/*      */ import com.zimbra.cs.account.AttributeManager;
/*      */ import com.zimbra.cs.account.Entry;
/*      */ import com.zimbra.cs.account.MailTarget;
/*      */ import com.zimbra.cs.account.NamedEntry;
/*      */ import com.zimbra.cs.account.Provisioning;
/*      */ import com.zimbra.soap.admin.message.GetAllEffectiveRightsResponse;
/*      */ import com.zimbra.soap.admin.message.GetEffectiveRightsResponse;
/*      */ import com.zimbra.soap.admin.type.EffectiveAttrInfo;
/*      */ import com.zimbra.soap.admin.type.EffectiveAttrsInfo;
/*      */ import com.zimbra.soap.admin.type.EffectiveRightsInfo;
/*      */ import com.zimbra.soap.admin.type.EffectiveRightsTarget;
/*      */ import com.zimbra.soap.admin.type.EffectiveRightsTargetInfo;
/*      */ import com.zimbra.soap.admin.type.EffectiveRightsTargetSelector;
/*      */ import com.zimbra.soap.admin.type.GranteeInfo;
/*      */ import com.zimbra.soap.admin.type.GranteeSelector;
/*      */ import com.zimbra.soap.admin.type.GranteeSelector.GranteeBy;
/*      */ import com.zimbra.soap.admin.type.InDomainInfo;
/*      */ import com.zimbra.soap.admin.type.RightWithName;
/*      */ import com.zimbra.soap.admin.type.RightsEntriesInfo;
/*      */ import com.zimbra.soap.type.NamedElement;
/*      */ import com.zimbra.soap.type.TargetBy;
/*      */ import java.util.ArrayList;
/*      */ import java.util.Arrays;
/*      */ import java.util.HashMap;
/*      */ import java.util.HashSet;
/*      */ import java.util.List;
/*      */ import java.util.Locale;
/*      */ import java.util.Map;
/*      */ import java.util.Map.Entry;
/*      */ import java.util.Set;
/*      */ import java.util.SortedMap;
/*      */ import java.util.TreeMap;
/*      */ import java.util.concurrent.TimeUnit;
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ public class RightCommand
/*      */ {
/*      */   private static final Cache<String, AllEffectiveRights> ALL_EFFECTIVE_RIGHTS_CACHE;
/*      */   private static final long MAX_CACHE_EXPIRY = 1800000L;
/*      */   
/*      */   public static class Grants
/*      */   {
/*   84 */     Set<RightCommand.ACE> mACEs = new HashSet();
/*      */     
/*      */     Grants() {}
/*      */     
/*      */     void addACE(RightCommand.ACE ace)
/*      */     {
/*   90 */       this.mACEs.add(ace);
/*      */     }
/*      */     
/*      */     public Set<RightCommand.ACE> getACEs() {
/*   94 */       return this.mACEs;
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */     public Grants(Element parent)
/*      */       throws ServiceException
/*      */     {
/*  102 */       for (Element eGrant : parent.listElements("grant"))
/*      */       {
/*  104 */         Element eTarget = eGrant.getElement("target");
/*  105 */         String targetType = eTarget.getAttribute("type", "");
/*  106 */         String targetId = eTarget.getAttribute("id", "");
/*  107 */         String targetName = eTarget.getAttribute("name", "");
/*      */         
/*      */ 
/*  110 */         Element eGrantee = eGrant.getElement("grantee");
/*  111 */         String granteeType = eGrantee.getAttribute("type", "");
/*  112 */         String granteeId = eGrantee.getAttribute("id", "");
/*  113 */         String granteeName = eGrantee.getAttribute("name", "");
/*      */         
/*      */ 
/*  116 */         Element eRight = eGrant.getElement("right");
/*  117 */         String right = eRight.getText();
/*  118 */         boolean deny = eRight.getAttributeBool("deny", false);
/*  119 */         boolean canDelegate = eRight.getAttributeBool("canDelegate", false);
/*  120 */         boolean disinheritSubGroups = eRight.getAttributeBool("disinheritSubGroups", false);
/*  121 */         boolean subDomain = eRight.getAttributeBool("subDomain", false);
/*      */         
/*  123 */         RightModifier rightModifier = null;
/*      */         
/*      */ 
/*      */ 
/*      */ 
/*  128 */         if (deny) {
/*  129 */           rightModifier = RightModifier.RM_DENY;
/*  130 */         } else if (canDelegate) {
/*  131 */           rightModifier = RightModifier.RM_CAN_DELEGATE;
/*  132 */         } else if (disinheritSubGroups) {
/*  133 */           rightModifier = RightModifier.RM_DISINHERIT_SUB_GROUPS;
/*  134 */         } else if (subDomain) {
/*  135 */           rightModifier = RightModifier.RM_SUBDOMAIN;
/*      */         }
/*  137 */         RightCommand.ACE ace = new RightCommand.ACE(targetType, targetId, targetName, granteeType, granteeId, granteeName, right, rightModifier, null);
/*      */         
/*      */ 
/*  140 */         addACE(ace);
/*      */       }
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */     private void addGrants(TargetType targetType, Entry target, ZimbraACL acl, Set<String> granteeFilter, Boolean isGranteeAnAdmin)
/*      */     {
/*  150 */       if (acl == null) {
/*  151 */         return;
/*      */       }
/*  153 */       for (ZimbraACE ace : acl.getAllACEs()) {
/*  154 */         boolean isAdminRight = !ace.getRight().isUserRight();
/*      */         
/*  156 */         if ((!isAdminRight) || (Boolean.FALSE != isGranteeAnAdmin))
/*      */         {
/*      */ 
/*      */ 
/*  160 */           if ((granteeFilter == null) || (granteeFilter.contains(ace.getGrantee()))) {
/*  161 */             addACE(new RightCommand.ACE(targetType, target, ace, null));
/*      */           }
/*      */         }
/*      */       }
/*      */     }
/*      */     
/*      */     public void toXML(Element parent)
/*      */     {
/*  169 */       for (RightCommand.ACE ace : this.mACEs)
/*      */       {
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*  176 */         Element eGrant = parent.addNonUniqueElement("grant");
/*      */         
/*  178 */         RightModifier rightModifier = ace.rightModifier();
/*  179 */         boolean deny = rightModifier == RightModifier.RM_DENY;
/*  180 */         boolean canDelegate = rightModifier == RightModifier.RM_CAN_DELEGATE;
/*  181 */         boolean disinheritSubGroups = rightModifier == RightModifier.RM_DISINHERIT_SUB_GROUPS;
/*  182 */         boolean subDomain = rightModifier == RightModifier.RM_SUBDOMAIN;
/*      */         
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*  193 */         Element eTarget = eGrant.addNonUniqueElement("target");
/*  194 */         eTarget.addAttribute("type", ace.targetType());
/*  195 */         eTarget.addAttribute("id", ace.targetId());
/*  196 */         eTarget.addAttribute("name", ace.targetName());
/*      */         
/*  198 */         Element eGrantee = eGrant.addNonUniqueElement("grantee");
/*  199 */         eGrantee.addAttribute("type", ace.granteeType());
/*  200 */         eGrantee.addAttribute("id", ace.granteeId());
/*  201 */         eGrantee.addAttribute("name", ace.granteeName());
/*      */         
/*  203 */         Element eRight = eGrant.addNonUniqueElement("right");
/*  204 */         eRight.addAttribute("deny", deny);
/*  205 */         eRight.addAttribute("canDelegate", canDelegate);
/*  206 */         eRight.addAttribute("disinheritSubGroups", disinheritSubGroups);
/*  207 */         eRight.addAttribute("subDomain", subDomain);
/*  208 */         eRight.setText(ace.right());
/*      */       }
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */   public static class ACE
/*      */   {
/*      */     private final String mTargetType;
/*      */     
/*      */     private final String mTargetId;
/*      */     
/*      */     private final String mTargetName;
/*      */     
/*      */     private final String mGranteeType;
/*      */     private final String mGranteeId;
/*      */     private final String mGranteeName;
/*      */     private final String mRight;
/*      */     private final RightModifier mRightModifier;
/*      */     
/*      */     private ACE(String targetType, String targetId, String targetName, String granteeType, String granteeId, String granteeName, String right, RightModifier rightModifier)
/*      */     {
/*  230 */       this.mTargetType = targetType;
/*  231 */       this.mTargetId = targetId;
/*  232 */       this.mTargetName = targetName;
/*  233 */       this.mGranteeType = granteeType;
/*  234 */       this.mGranteeId = granteeId;
/*  235 */       this.mGranteeName = granteeName;
/*  236 */       this.mRight = right;
/*  237 */       this.mRightModifier = rightModifier;
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */     private ACE(TargetType targetType, Entry target, ZimbraACE ace)
/*      */     {
/*  244 */       this.mTargetType = targetType.getCode();
/*  245 */       this.mTargetId = TargetType.getId(target);
/*  246 */       this.mTargetName = target.getLabel();
/*  247 */       this.mGranteeType = ace.getGranteeType().getCode();
/*  248 */       this.mGranteeId = ace.getGrantee();
/*  249 */       this.mGranteeName = ace.getGranteeDisplayName();
/*  250 */       this.mRight = ace.getRight().getName();
/*  251 */       this.mRightModifier = ace.getRightModifier();
/*      */     }
/*      */     
/*  254 */     public String targetType() { return this.mTargetType; }
/*  255 */     public String targetId() { return this.mTargetId != null ? this.mTargetId : ""; }
/*  256 */     public String targetName() { return this.mTargetName; }
/*  257 */     public String granteeType() { return this.mGranteeType; }
/*  258 */     public String granteeId() { return this.mGranteeId; }
/*  259 */     public String granteeName() { return this.mGranteeName; }
/*  260 */     public String right() { return this.mRight; }
/*  261 */     public RightModifier rightModifier() { return this.mRightModifier; }
/*      */   }
/*      */   
/*      */   public static class EffectiveAttr {
/*  265 */     private static final Set<String> EMPTY_SET = new HashSet();
/*      */     String mAttrName;
/*      */     Set<String> mDefault;
/*      */     AttributeConstraint mConstraint;
/*      */     
/*      */     EffectiveAttr(String attrName, Set<String> defaultValue, AttributeConstraint constraint)
/*      */     {
/*  272 */       this.mAttrName = attrName;
/*  273 */       this.mDefault = defaultValue;
/*  274 */       this.mConstraint = constraint;
/*      */     }
/*      */     
/*  277 */     public String getAttrName() { return this.mAttrName; }
/*      */     
/*      */     public Set<String> getDefault() {
/*  280 */       if (this.mDefault == null) {
/*  281 */         return EMPTY_SET;
/*      */       }
/*  283 */       return this.mDefault;
/*      */     }
/*      */     
/*      */     AttributeConstraint getConstraint() {
/*  287 */       return this.mConstraint;
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */   public static class EffectiveRights
/*      */   {
/*  294 */     private static final SortedMap<String, RightCommand.EffectiveAttr> EMPTY_MAP = new TreeMap();
/*      */     
/*      */     String mTargetType;
/*      */     
/*      */     String mTargetId;
/*      */     
/*      */     String mTargetName;
/*      */     
/*      */     String mGranteeId;
/*      */     String mGranteeName;
/*      */     String mDigest;
/*  305 */     List<String> mPresetRights = new ArrayList();
/*      */     
/*      */ 
/*  308 */     boolean mCanSetAllAttrs = false;
/*  309 */     SortedMap<String, RightCommand.EffectiveAttr> mCanSetAttrs = EMPTY_MAP;
/*      */     
/*      */ 
/*  312 */     boolean mCanGetAllAttrs = false;
/*  313 */     SortedMap<String, RightCommand.EffectiveAttr> mCanGetAttrs = EMPTY_MAP;
/*      */     
/*      */     EffectiveRights(String targetType, String targetId, String targetName, String granteeId, String granteeName)
/*      */     {
/*  317 */       this.mTargetType = targetType;
/*  318 */       this.mTargetId = (targetId == null ? "" : targetId);
/*  319 */       this.mTargetName = targetName;
/*  320 */       this.mGranteeId = granteeId;
/*  321 */       this.mGranteeName = granteeName;
/*      */     }
/*      */     
/*      */     private EffectiveRights() {}
/*      */     
/*      */     private boolean hasSameRights(EffectiveRights other)
/*      */     {
/*  328 */       return getDigest().equals(other.getDigest());
/*      */     }
/*      */     
/*      */     private boolean hasNoRight() {
/*  332 */       return (this.mPresetRights.isEmpty()) && (!this.mCanSetAllAttrs) && (this.mCanSetAttrs.isEmpty()) && (!this.mCanGetAllAttrs) && (this.mCanGetAttrs.isEmpty());
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */     private String getDigest()
/*      */     {
/*  346 */       if (this.mDigest != null) {
/*  347 */         return this.mDigest;
/*      */       }
/*  349 */       StringBuilder rights = new StringBuilder();
/*      */       
/*      */ 
/*  352 */       rights.append("preset:" + this.mPresetRights.hashCode() + ";");
/*      */       
/*      */ 
/*  355 */       rights.append("setAttrs:");
/*  356 */       if (this.mCanSetAllAttrs) {
/*  357 */         rights.append("all;");
/*      */       } else {
/*  359 */         List<String> attrs = new ArrayList(this.mCanSetAttrs.keySet());
/*  360 */         rights.append(attrs.hashCode() + ";");
/*      */       }
/*      */       
/*      */ 
/*  364 */       rights.append("getAttrs:");
/*  365 */       if (this.mCanGetAllAttrs) {
/*  366 */         rights.append("all;");
/*      */       } else {
/*  368 */         List<String> attrs = new ArrayList(this.mCanGetAttrs.keySet());
/*  369 */         rights.append(attrs.hashCode() + ";");
/*      */       }
/*      */       
/*  372 */       this.mDigest = rights.toString();
/*  373 */       return this.mDigest;
/*      */     }
/*      */     
/*      */     public static EffectiveRights fromJaxb_EffectiveRights(GetEffectiveRightsResponse resp)
/*      */       throws ServiceException
/*      */     {
/*  379 */       EffectiveRights er = fromJaxb(resp.getTarget());
/*  380 */       er.mGranteeId = resp.getGrantee().getId();
/*  381 */       er.mGranteeName = resp.getGrantee().getName();
/*  382 */       return er;
/*      */     }
/*      */     
/*      */     public static EffectiveRights fromXML_CreateObjectAttrs(Element parent) throws ServiceException
/*      */     {
/*  387 */       EffectiveRights er = new EffectiveRights();
/*      */       
/*      */ 
/*  390 */       Element eSetAttrs = parent.getElement("setAttrs");
/*  391 */       if (eSetAttrs.getAttributeBool("all", false)) {
/*  392 */         er.mCanSetAllAttrs = true;
/*      */       }
/*  394 */       er.mCanSetAttrs = fromXML_attrs(eSetAttrs);
/*      */       
/*  396 */       return er;
/*      */     }
/*      */     
/*      */     private static EffectiveRights fromJaxb(EffectiveRightsInfo eRights) throws ServiceException
/*      */     {
/*  401 */       EffectiveRights er = new EffectiveRights();
/*      */       
/*      */ 
/*  404 */       er.mPresetRights = new ArrayList();
/*  405 */       for (RightWithName eRight : eRights.getRights()) {
/*  406 */         er.mPresetRights.add(eRight.getName());
/*      */       }
/*      */       
/*  409 */       EffectiveAttrsInfo eSetAttrs = eRights.getSetAttrs();
/*  410 */       Boolean setAll = eSetAttrs.getAll();
/*  411 */       er.mCanSetAllAttrs = ((setAll != null) && (setAll.booleanValue()));
/*  412 */       er.mCanSetAttrs = from_attrs(eSetAttrs);
/*      */       
/*      */ 
/*  415 */       EffectiveAttrsInfo eGetAttrs = eRights.getGetAttrs();
/*  416 */       Boolean getAll = eGetAttrs.getAll();
/*  417 */       er.mCanGetAllAttrs = ((getAll != null) && (getAll.booleanValue()));
/*  418 */       er.mCanGetAttrs = from_attrs(eGetAttrs);
/*  419 */       if ((eRights instanceof EffectiveRightsTargetInfo)) {
/*  420 */         EffectiveRightsTargetInfo eTargInfo = (EffectiveRightsTargetInfo)eRights;
/*      */         
/*  422 */         er.mTargetType = eTargInfo.getType().toString();
/*  423 */         er.mTargetId = eTargInfo.getId();
/*  424 */         er.mTargetName = eTargInfo.getName();
/*      */       }
/*  426 */       return er;
/*      */     }
/*      */     
/*      */     private static TreeMap<String, RightCommand.EffectiveAttr> from_attrs(EffectiveAttrsInfo eAttrs)
/*      */       throws ServiceException
/*      */     {
/*  432 */       TreeMap<String, RightCommand.EffectiveAttr> attrs = new TreeMap();
/*  433 */       AttributeManager am = AttributeManager.getInstance();
/*      */       
/*  435 */       for (EffectiveAttrInfo eAttr : eAttrs.getAttrs()) {
/*  436 */         String attrName = eAttr.getName();
/*      */         
/*      */ 
/*  439 */         AttributeConstraint constraint = AttributeConstraint.fromJaxb(am, attrName, eAttr.getConstraint());
/*      */         
/*      */ 
/*      */ 
/*      */ 
/*  444 */         Set<String> defaultValues = null;
/*  445 */         List<String> values = eAttr.getValues();
/*  446 */         if ((values != null) && (values.size() > 0)) {
/*  447 */           defaultValues = Sets.newHashSet();
/*  448 */           defaultValues.addAll(values);
/*      */         }
/*      */         
/*      */ 
/*      */ 
/*  453 */         RightCommand.EffectiveAttr ea = new RightCommand.EffectiveAttr(attrName, defaultValues, null);
/*      */         
/*  455 */         attrs.put(attrName, ea);
/*      */       }
/*  457 */       return attrs;
/*      */     }
/*      */     
/*      */     private static TreeMap<String, RightCommand.EffectiveAttr> fromXML_attrs(Element eAttrs) throws ServiceException
/*      */     {
/*  462 */       TreeMap<String, RightCommand.EffectiveAttr> attrs = new TreeMap();
/*      */       
/*  464 */       AttributeManager am = AttributeManager.getInstance();
/*      */       
/*  466 */       for (Element eAttr : eAttrs.listElements("a")) {
/*  467 */         String attrName = eAttr.getAttribute("n");
/*      */         
/*      */ 
/*  470 */         AttributeConstraint constraint = null;
/*  471 */         Element eConstraint = eAttr.getOptionalElement("constraint");
/*  472 */         if (eConstraint != null) {
/*  473 */           constraint = AttributeConstraint.fromXML(am, attrName, eConstraint);
/*      */         }
/*      */         
/*  476 */         Element eDefault = eAttr.getOptionalElement("default");
/*  477 */         Set<String> defaultValues = null;
/*  478 */         if (eDefault != null) {
/*  479 */           defaultValues = new HashSet();
/*  480 */           for (Element eValue : eDefault.listElements("v")) {
/*  481 */             defaultValues.add(eValue.getText());
/*      */           }
/*      */         }
/*      */         
/*  485 */         RightCommand.EffectiveAttr ea = new RightCommand.EffectiveAttr(attrName, defaultValues, null);
/*  486 */         attrs.put(attrName, ea);
/*      */       }
/*      */       
/*  489 */       return attrs;
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */     public void toXML_getEffectiveRights(Element parent)
/*      */     {
/*  496 */       Element eGrantee = parent.addNonUniqueElement("grantee");
/*  497 */       eGrantee.addAttribute("id", this.mGranteeId);
/*  498 */       eGrantee.addAttribute("name", this.mGranteeName);
/*      */       
/*      */ 
/*      */ 
/*      */ 
/*  503 */       Element eTarget = parent.addNonUniqueElement("target");
/*  504 */       eTarget.addAttribute("type", this.mTargetType);
/*  505 */       eTarget.addAttribute("id", this.mTargetId);
/*  506 */       eTarget.addAttribute("name", this.mTargetName);
/*      */       
/*  508 */       toXML(eTarget);
/*      */     }
/*      */     
/*      */     public void toXML_getCreateObjectAttrs(Element parent)
/*      */     {
/*  513 */       toXML(parent, "setAttrs", this.mCanSetAllAttrs, this.mCanSetAttrs);
/*      */     }
/*      */     
/*      */     private void toXML(Element eParent)
/*      */     {
/*  518 */       for (String r : this.mPresetRights) {
/*  519 */         eParent.addNonUniqueElement("right").addAttribute("n", r);
/*      */       }
/*      */       
/*      */ 
/*  523 */       toXML(eParent, "setAttrs", this.mCanSetAllAttrs, this.mCanSetAttrs);
/*      */       
/*      */ 
/*  526 */       toXML(eParent, "getAttrs", this.mCanGetAllAttrs, this.mCanGetAttrs);
/*      */     }
/*      */     
/*      */     private void toXML(Element parent, String elemName, boolean allAttrs, SortedMap<String, RightCommand.EffectiveAttr> attrs)
/*      */     {
/*  531 */       Element eAttrs = parent.addNonUniqueElement(elemName);
/*  532 */       if (allAttrs) {
/*  533 */         eAttrs.addAttribute("all", true);
/*      */       }
/*      */       
/*  536 */       for (RightCommand.EffectiveAttr ea : attrs.values()) {
/*  537 */         Element eAttr = eAttrs.addNonUniqueElement("a");
/*  538 */         attrName = ea.getAttrName();
/*  539 */         eAttr.addAttribute("n", attrName);
/*      */         
/*      */ 
/*  542 */         AttributeConstraint constraint = ea.getConstraint();
/*  543 */         if (constraint != null) {
/*  544 */           constraint.toXML(eAttr);
/*      */         }
/*      */         
/*  547 */         if (!ea.getDefault().isEmpty()) {
/*  548 */           eDefault = eAttr.addNonUniqueElement("default");
/*  549 */           for (String v : ea.getDefault()) {
/*  550 */             Element valueElem = eDefault.addNonUniqueElement("v");
/*  551 */             valueElem.setText(Provisioning.sanitizedAttrValue(attrName, v).toString());
/*      */           }
/*      */         }
/*      */       }
/*      */       String attrName;
/*      */       Element eDefault; }
/*      */     
/*  558 */     void setPresetRights(List<String> presetRights) { this.mPresetRights = presetRights; }
/*  559 */     void setCanSetAllAttrs() { this.mCanSetAllAttrs = true; }
/*  560 */     void setCanSetAttrs(SortedMap<String, RightCommand.EffectiveAttr> canSetAttrs) { this.mCanSetAttrs = canSetAttrs; }
/*  561 */     void setCanGetAllAttrs() { this.mCanGetAllAttrs = true; }
/*  562 */     void setCanGetAttrs(SortedMap<String, RightCommand.EffectiveAttr> canGetAttrs) { this.mCanGetAttrs = canGetAttrs; }
/*      */     
/*  564 */     public String targetType() { return this.mTargetType; }
/*  565 */     public String targetId() { return this.mTargetId; }
/*  566 */     public String targetName() { return this.mTargetName; }
/*  567 */     public String granteeId() { return this.mGranteeId; }
/*  568 */     public String granteeName() { return this.mGranteeName; }
/*  569 */     public List<String> presetRights() { return this.mPresetRights; }
/*  570 */     public boolean canSetAllAttrs() { return this.mCanSetAllAttrs; }
/*  571 */     public SortedMap<String, RightCommand.EffectiveAttr> canSetAttrs() { return this.mCanSetAttrs; }
/*  572 */     public boolean canGetAllAttrs() { return this.mCanGetAllAttrs; }
/*  573 */     public SortedMap<String, RightCommand.EffectiveAttr> canGetAttrs() { return this.mCanGetAttrs; }
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */   public static class RightAggregation
/*      */   {
/*      */     Set<String> mEntries;
/*      */     
/*      */ 
/*      */ 
/*      */     RightCommand.EffectiveRights mRights;
/*      */     
/*      */ 
/*  588 */     public Set<String> entries() { return this.mEntries; }
/*  589 */     public RightCommand.EffectiveRights effectiveRights() { return this.mRights; }
/*      */     
/*      */     private RightAggregation(String name, RightCommand.EffectiveRights rights) {
/*  592 */       this.mEntries = new HashSet();
/*  593 */       this.mEntries.add(name);
/*  594 */       this.mRights = rights;
/*      */     }
/*      */     
/*      */     private RightAggregation(Set<String> names, RightCommand.EffectiveRights rights) {
/*  598 */       this.mEntries = new HashSet();
/*  599 */       this.mEntries.addAll(names);
/*  600 */       this.mRights = rights;
/*      */     }
/*      */     
/*      */     private RightCommand.EffectiveRights getRights() {
/*  604 */       return this.mRights;
/*      */     }
/*      */     
/*      */     private void addEntry(String name) {
/*  608 */       this.mEntries.add(name);
/*      */     }
/*      */     
/*      */     private void addEntries(Set<String> names) {
/*  612 */       this.mEntries.addAll(names);
/*      */     }
/*      */     
/*      */     private boolean hasEntry(String name) {
/*  616 */       return this.mEntries.contains(name);
/*      */     }
/*      */     
/*      */     private void removeEntry(String name) {
/*  620 */       this.mEntries.remove(name);
/*      */     }
/*      */     
/*      */     private boolean hasSameRights(RightCommand.EffectiveRights er) {
/*  624 */       return RightCommand.EffectiveRights.access$200(this.mRights, er);
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static class RightsByTargetType
/*      */   {
/*  636 */     RightCommand.EffectiveRights mAll = null;
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*  643 */     Set<RightCommand.RightAggregation> mEntries = new HashSet();
/*      */     
/*  645 */     public RightCommand.EffectiveRights all() { return this.mAll; }
/*  646 */     public Set<RightCommand.RightAggregation> entries() { return this.mEntries; }
/*      */     
/*      */     void setAll(RightCommand.EffectiveRights er) {
/*  649 */       this.mAll = er;
/*      */     }
/*      */     
/*      */     protected static void add(Set<RightCommand.RightAggregation> entries, String name, RightCommand.EffectiveRights er)
/*      */     {
/*  654 */       for (RightCommand.RightAggregation ra : entries) {
/*  655 */         if (RightCommand.RightAggregation.access$300(ra, name)) {
/*  656 */           RightCommand.RightAggregation.access$400(ra, name);
/*  657 */           break;
/*      */         }
/*      */       }
/*      */       
/*      */ 
/*      */ 
/*  663 */       for (RightCommand.RightAggregation ra : entries) {
/*  664 */         if (RightCommand.RightAggregation.access$500(ra, er)) {
/*  665 */           RightCommand.RightAggregation.access$600(ra, name);
/*  666 */           return;
/*      */         }
/*      */       }
/*  669 */       entries.add(new RightCommand.RightAggregation(name, er, null));
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */     protected static void addAggregation(Set<RightCommand.RightAggregation> entries, Set<String> names, RightCommand.EffectiveRights er)
/*      */     {
/*  677 */       for (RightCommand.RightAggregation ra : entries) {
/*  678 */         if (RightCommand.RightAggregation.access$500(ra, er)) {
/*  679 */           RightCommand.RightAggregation.access$800(ra, names);
/*  680 */           return;
/*      */         }
/*      */       }
/*  683 */       entries.add(new RightCommand.RightAggregation(names, er, null));
/*      */     }
/*      */     
/*      */     private void addEntry(String name, RightCommand.EffectiveRights er) {
/*  687 */       add(this.mEntries, name, er);
/*      */     }
/*      */     
/*      */     private void addAggregation(Set<String> names, RightCommand.EffectiveRights er) {
/*  691 */       addAggregation(this.mEntries, names, er);
/*      */     }
/*      */     
/*      */     public boolean hasNoRight() {
/*  695 */       return (this.mAll == null) && (this.mEntries.isEmpty());
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static class DomainedRightsByTargetType
/*      */     extends RightCommand.RightsByTargetType
/*      */   {
/*  722 */     Set<RightCommand.RightAggregation> mDomains = new HashSet();
/*      */     
/*  724 */     public Set<RightCommand.RightAggregation> domains() { return this.mDomains; }
/*      */     
/*      */     void addDomainEntry(String domainName, RightCommand.EffectiveRights er) {
/*  727 */       add(this.mDomains, domainName, er);
/*      */     }
/*      */     
/*      */     public boolean hasNoRight()
/*      */     {
/*  732 */       return (super.hasNoRight()) && (this.mDomains.isEmpty());
/*      */     }
/*      */   }
/*      */   
/*      */   public static class AllEffectiveRights
/*      */   {
/*      */     String mGranteeType;
/*      */     String mGranteeId;
/*      */     String mGranteeName;
/*  741 */     Map<TargetType, RightCommand.RightsByTargetType> mRightsByTargetType = new HashMap();
/*      */     
/*      */     AllEffectiveRights(String granteeType, String granteeId, String granteeName)
/*      */     {
/*  745 */       this.mGranteeType = granteeType;
/*  746 */       this.mGranteeId = granteeId;
/*  747 */       this.mGranteeName = granteeName;
/*      */       
/*  749 */       for (TargetType tt : TargetType.values())
/*  750 */         if (tt.isDomained()) {
/*  751 */           this.mRightsByTargetType.put(tt, new RightCommand.DomainedRightsByTargetType());
/*      */         } else {
/*  753 */           this.mRightsByTargetType.put(tt, new RightCommand.RightsByTargetType());
/*      */         }
/*      */     }
/*      */     
/*  757 */     public String granteeType() { return this.mGranteeType; }
/*      */     
/*  759 */     public String granteeId() { return this.mGranteeId; }
/*      */     
/*  761 */     public String granteeName() { return this.mGranteeName; }
/*      */     
/*  763 */     public Map<TargetType, RightCommand.RightsByTargetType> rightsByTargetType() { return this.mRightsByTargetType; }
/*      */     
/*      */     void setAll(TargetType targetType, RightCommand.EffectiveRights er) {
/*  766 */       if (RightCommand.EffectiveRights.access$1000(er))
/*  767 */         return;
/*  768 */       ((RightCommand.RightsByTargetType)this.mRightsByTargetType.get(targetType)).setAll(er);
/*      */     }
/*      */     
/*      */     void addEntry(TargetType targetType, String name, RightCommand.EffectiveRights er) {
/*  772 */       if (RightCommand.EffectiveRights.access$1000(er))
/*  773 */         return;
/*  774 */       RightCommand.RightsByTargetType.access$1100((RightCommand.RightsByTargetType)this.mRightsByTargetType.get(targetType), name, er);
/*      */     }
/*      */     
/*      */     void addAggregation(TargetType targetType, Set<String> names, RightCommand.EffectiveRights er) {
/*  778 */       if (RightCommand.EffectiveRights.access$1000(er))
/*  779 */         return;
/*  780 */       RightCommand.RightsByTargetType.access$1200((RightCommand.RightsByTargetType)this.mRightsByTargetType.get(targetType), names, er);
/*      */     }
/*      */     
/*      */     void addDomainEntry(TargetType targetType, String domainName, RightCommand.EffectiveRights er) {
/*  784 */       if (RightCommand.EffectiveRights.access$1000(er))
/*  785 */         return;
/*  786 */       RightCommand.DomainedRightsByTargetType drbtt = (RightCommand.DomainedRightsByTargetType)this.mRightsByTargetType.get(targetType);
/*      */       
/*  788 */       drbtt.addDomainEntry(domainName, er);
/*      */     }
/*      */     
/*      */     public static AllEffectiveRights fromJaxb(GetAllEffectiveRightsResponse resp) throws ServiceException
/*      */     {
/*  793 */       GranteeInfo grantee = resp.getGrantee();
/*  794 */       com.zimbra.soap.type.GranteeType gt = grantee.getType();
/*  795 */       String granteeType = gt == null ? null : gt.toString();
/*      */       
/*  797 */       AllEffectiveRights aer = new AllEffectiveRights(granteeType, grantee.getId(), grantee.getName());
/*      */       
/*      */ 
/*  800 */       for (EffectiveRightsTarget target : resp.getTargets()) {
/*  801 */         TargetType targetType = TargetType.fromCode(target.getType().toString());
/*      */         
/*  803 */         rbtt = (RightCommand.RightsByTargetType)aer.mRightsByTargetType.get(targetType);
/*      */         
/*  805 */         EffectiveRightsInfo allR = target.getAll();
/*  806 */         if (allR != null) {
/*  807 */           rbtt.mAll = RightCommand.EffectiveRights.access$1300(allR);
/*      */         }
/*      */         RightCommand.DomainedRightsByTargetType drbtt;
/*  810 */         if ((rbtt instanceof RightCommand.DomainedRightsByTargetType)) {
/*  811 */           drbtt = (RightCommand.DomainedRightsByTargetType)rbtt;
/*      */           
/*  813 */           for (InDomainInfo inDomInfo : target.getInDomainLists()) {
/*  814 */             Set<String> domains = new HashSet();
/*  815 */             for (NamedElement dom : inDomInfo.getDomains())
/*  816 */               domains.add(dom.getName());
/*  817 */             RightCommand.EffectiveRights er = RightCommand.EffectiveRights.access$1300(inDomInfo.getRights());
/*      */             
/*  819 */             RightCommand.RightAggregation ra = new RightCommand.RightAggregation(domains, er, null);
/*  820 */             drbtt.mDomains.add(ra);
/*      */           }
/*      */         }
/*  823 */         for (RightsEntriesInfo eEntries : target.getEntriesLists()) {
/*  824 */           Set<String> entries = new HashSet();
/*  825 */           for (NamedElement eEntry : eEntries.getEntries())
/*  826 */             entries.add(eEntry.getName());
/*  827 */           RightCommand.EffectiveRights er = RightCommand.EffectiveRights.access$1300(eEntries.getRights());
/*  828 */           RightCommand.RightAggregation ra = new RightCommand.RightAggregation(entries, er, null);
/*  829 */           rbtt.mEntries.add(ra);
/*      */         } }
/*      */       RightCommand.RightsByTargetType rbtt;
/*  832 */       return aer;
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */     public void toXML(Element parent)
/*      */     {
/*  839 */       Element eGrantee = parent.addNonUniqueElement("grantee");
/*  840 */       eGrantee.addAttribute("type", this.mGranteeType);
/*  841 */       eGrantee.addAttribute("id", this.mGranteeId);
/*  842 */       eGrantee.addAttribute("name", this.mGranteeName);
/*      */       
/*      */ 
/*      */ 
/*      */ 
/*  847 */       for (Map.Entry<TargetType, RightCommand.RightsByTargetType> rightsByTargetType : this.mRightsByTargetType.entrySet()) {
/*  848 */         TargetType targetType = (TargetType)rightsByTargetType.getKey();
/*  849 */         RightCommand.RightsByTargetType rbtt = (RightCommand.RightsByTargetType)rightsByTargetType.getValue();
/*      */         
/*  851 */         eTarget = parent.addNonUniqueElement("target");
/*  852 */         eTarget.addAttribute("type", targetType.getCode());
/*      */         
/*  854 */         er = rbtt.all();
/*  855 */         if (er != null) {
/*  856 */           Element eAll = eTarget.addNonUniqueElement("all");
/*  857 */           RightCommand.EffectiveRights.access$1400(er, eAll);
/*      */         }
/*      */         
/*  860 */         if ((rbtt instanceof RightCommand.DomainedRightsByTargetType)) {
/*  861 */           RightCommand.DomainedRightsByTargetType domainedRights = (RightCommand.DomainedRightsByTargetType)rbtt;
/*      */           
/*      */ 
/*  864 */           for (RightCommand.RightAggregation rightsByDomains : domainedRights.domains()) {
/*  865 */             Element eInDomains = eTarget.addNonUniqueElement("inDomains");
/*  866 */             for (String domain : rightsByDomains.entries()) {
/*  867 */               Element eDomain = eInDomains.addNonUniqueElement("domain");
/*  868 */               eDomain.addAttribute("name", domain);
/*      */             }
/*  870 */             Element eRights = eInDomains.addNonUniqueElement("rights");
/*  871 */             er = RightCommand.RightAggregation.access$1500(rightsByDomains);
/*  872 */             RightCommand.EffectiveRights.access$1400(er, eRights);
/*      */           }
/*      */         }
/*      */         
/*  876 */         for (RightCommand.RightAggregation rightsByEntries : rbtt.entries()) {
/*  877 */           Element eEntries = eTarget.addNonUniqueElement("entries");
/*  878 */           for (String entry : rightsByEntries.entries()) {
/*  879 */             Element eEntry = eEntries.addNonUniqueElement("entry");
/*  880 */             eEntry.addAttribute("name", entry);
/*      */           }
/*  882 */           Element eRights = eEntries.addNonUniqueElement("rights");
/*  883 */           er = RightCommand.RightAggregation.access$1500(rightsByEntries);
/*  884 */           RightCommand.EffectiveRights.access$1400(er, eRights);
/*      */         }
/*      */       }
/*      */       Element eTarget;
/*      */       RightCommand.EffectiveRights er;
/*      */     }
/*      */   }
/*      */   
/*  892 */   private static void verifyAccessManager() throws ServiceException { if (!(AccessManager.getInstance() instanceof ACLAccessManager)) {
/*  893 */       throw ServiceException.FAILURE("method is not supported by the current AccessManager: " + AccessManager.getInstance().getClass().getCanonicalName() + ", this method requires access manager " + ACLAccessManager.class.getCanonicalName(), null);
/*      */     }
/*      */   }
/*      */   
/*      */   private static AdminConsoleCapable verifyAdminConsoleCapable()
/*      */     throws ServiceException
/*      */   {
/*  900 */     AccessManager am = AccessManager.getInstance();
/*      */     
/*  902 */     if ((am instanceof AdminConsoleCapable)) {
/*  903 */       return (AdminConsoleCapable)am;
/*      */     }
/*  905 */     throw ServiceException.FAILURE("method is not supported by the current AccessManager: " + AccessManager.getInstance().getClass().getCanonicalName() + ", this method requires an admin console capable access manager", null);
/*      */   }
/*      */   
/*      */   public static Right getRight(String rightName)
/*      */     throws ServiceException
/*      */   {
/*  911 */     verifyAccessManager();
/*  912 */     return RightManager.getInstance().getRight(rightName);
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static List<Right> getAllRights(String targetType, String rightClass)
/*      */     throws ServiceException
/*      */   {
/*  929 */     verifyAccessManager();
/*      */     
/*  931 */     List<Right> result = new ArrayList();
/*      */     
/*  933 */     TargetType tt = targetType == null ? null : TargetType.fromCode(targetType);
/*  934 */     RightClass rc = rightClass == null ? RightClass.ADMIN : RightClass.fromString(rightClass);
/*      */     
/*  936 */     switch (rc) {
/*      */     case USER: 
/*  938 */       getAllRights(tt, RightManager.getInstance().getAllUserRights(), result);
/*  939 */       break;
/*      */     case ALL: 
/*  941 */       getAllRights(tt, RightManager.getInstance().getAllAdminRights(), result);
/*  942 */       getAllRights(tt, RightManager.getInstance().getAllUserRights(), result);
/*  943 */       break;
/*      */     
/*      */     case ADMIN: 
/*      */     default: 
/*  947 */       getAllRights(tt, RightManager.getInstance().getAllAdminRights(), result);
/*      */     }
/*      */     
/*  950 */     return result;
/*      */   }
/*      */   
/*      */ 
/*      */   private static void getAllRights(TargetType targetType, Map<String, ? extends Right> rights, List<Right> result)
/*      */     throws ServiceException
/*      */   {
/*  957 */     for (Map.Entry<String, ? extends Right> right : rights.entrySet()) {
/*  958 */       Right r = (Right)right.getValue();
/*  959 */       if ((targetType == null) || (r.grantableOnTargetType(targetType))) {
/*  960 */         result.add(r);
/*      */       }
/*      */     }
/*      */   }
/*      */   
/*      */   public static boolean checkRight(Provisioning prov, String targetType, TargetBy targetBy, String target, MailTarget grantee, String right, Map<String, Object> attrs, AccessManager.ViaGrant via)
/*      */     throws ServiceException
/*      */   {
/*  968 */     verifyAccessManager();
/*      */     
/*      */ 
/*  971 */     TargetType tt = TargetType.fromCode(targetType);
/*  972 */     Entry targetEntry = TargetType.lookupTarget(prov, tt, targetBy, target);
/*      */     
/*      */ 
/*  975 */     Right r = RightManager.getInstance().getRight(right);
/*      */     
/*  977 */     if (r.getRightType() != Right.RightType.setAttrs)
/*      */     {
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*  983 */       if ((attrs != null) && (!attrs.isEmpty())) {
/*  984 */         throw ServiceException.INVALID_REQUEST("attr map is not allowed for checking a non-setAttrs right: " + r.getName(), null);
/*      */       }
/*      */     }
/*      */     
/*  988 */     AccessManager am = AccessManager.getInstance();
/*      */     
/*      */ 
/*  991 */     boolean asAdmin = (grantee instanceof Account) ? am.isAdequateAdminAccount((Account)grantee) : false;
/*  992 */     boolean result = am.canPerform(grantee, targetEntry, r, false, attrs, asAdmin, via);
/*  993 */     return result;
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   static
/*      */   {
/* 1004 */     long allEffectiveRightsCacheSize = 0L;
/* 1005 */     long allEffectiveRightsCacheExpireAfterMillis = 0L;
/* 1006 */     allEffectiveRightsCacheSize = LC.short_term_all_effective_rights_cache_size.longValue();
/* 1007 */     if (allEffectiveRightsCacheSize > 0L) {
/* 1008 */       allEffectiveRightsCacheExpireAfterMillis = LC.short_term_all_effective_rights_cache_expiration.longValue();
/* 1009 */       if (allEffectiveRightsCacheExpireAfterMillis < 0L) {
/* 1010 */         allEffectiveRightsCacheExpireAfterMillis = 0L;
/* 1011 */         allEffectiveRightsCacheSize = 0L;
/* 1012 */       } else if (allEffectiveRightsCacheExpireAfterMillis > 1800000L) {
/* 1013 */         allEffectiveRightsCacheExpireAfterMillis = 1800000L;
/*      */       }
/*      */     }
/*      */     
/* 1017 */     if (allEffectiveRightsCacheSize > 0L) {
/* 1018 */       ALL_EFFECTIVE_RIGHTS_CACHE = CacheBuilder.newBuilder().maximumSize(allEffectiveRightsCacheSize).expireAfterWrite(allEffectiveRightsCacheExpireAfterMillis, TimeUnit.MILLISECONDS).build();
/*      */ 
/*      */ 
/*      */     }
/*      */     else
/*      */     {
/*      */ 
/* 1025 */       ALL_EFFECTIVE_RIGHTS_CACHE = null;
/*      */     }
/*      */   }
/*      */   
/*      */   public static void clearAllEffectiveRightsCache() {
/* 1030 */     if (null != ALL_EFFECTIVE_RIGHTS_CACHE) {
/* 1031 */       ZimbraLog.acl.debug("Clearing short term all effective rights cache of %d items.", new Object[] { Long.valueOf(ALL_EFFECTIVE_RIGHTS_CACHE.size()) });
/*      */       
/* 1033 */       ALL_EFFECTIVE_RIGHTS_CACHE.invalidateAll();
/*      */     }
/*      */   }
/*      */   
/*      */   private static AllEffectiveRights getAllEffectiveRights(AdminConsoleCapable acc, GranteeType granteeType, NamedEntry granteeEntry, RightBearer rightBearer, boolean expandSetAttrs, boolean expandGetAttrs)
/*      */     throws ServiceException
/*      */   {
/* 1040 */     AllEffectiveRights aer = new AllEffectiveRights(granteeType.getCode(), granteeEntry.getId(), granteeEntry.getName());
/*      */     
/* 1042 */     acc.getAllEffectiveRights(rightBearer, expandSetAttrs, expandGetAttrs, aer);
/* 1043 */     return aer;
/*      */   }
/*      */   
/*      */   public static AllEffectiveRights getAllEffectiveRights(Provisioning prov, String granteeType, GranteeSelector.GranteeBy granteeBy, String grantee, boolean expandSetAttrs, boolean expandGetAttrs)
/*      */     throws ServiceException
/*      */   {
/* 1049 */     AdminConsoleCapable acc = verifyAdminConsoleCapable();
/*      */     
/*      */ 
/* 1052 */     GranteeType gt = GranteeType.fromCode(granteeType);
/* 1053 */     NamedEntry granteeEntry = GranteeType.lookupGrantee(prov, gt, granteeBy, grantee);
/* 1054 */     RightBearer rightBearer = RightBearer.newRightBearer(granteeEntry);
/*      */     
/*      */ 
/* 1057 */     String cacheKey = null;
/* 1058 */     AllEffectiveRights aer; if (ALL_EFFECTIVE_RIGHTS_CACHE != null) {
/* 1059 */       cacheKey = String.format("%s-%s-%s-%b-%b", new Object[] { rightBearer.getId(), gt.getCode(), granteeEntry.getId(), Boolean.valueOf(expandSetAttrs), Boolean.valueOf(expandGetAttrs) });
/*      */       
/* 1061 */       AllEffectiveRights aer = (AllEffectiveRights)ALL_EFFECTIVE_RIGHTS_CACHE.getIfPresent(cacheKey);
/* 1062 */       if (aer == null) {
/* 1063 */         aer = getAllEffectiveRights(acc, gt, granteeEntry, rightBearer, expandSetAttrs, expandGetAttrs);
/* 1064 */         ALL_EFFECTIVE_RIGHTS_CACHE.put(cacheKey, aer);
/*      */       }
/*      */     } else {
/* 1067 */       aer = getAllEffectiveRights(acc, gt, granteeEntry, rightBearer, expandSetAttrs, expandGetAttrs);
/*      */     }
/* 1069 */     return aer;
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */   public static EffectiveRights getEffectiveRights(Provisioning prov, String targetType, TargetBy targetBy, String target, GranteeSelector.GranteeBy granteeBy, String grantee, boolean expandSetAttrs, boolean expandGetAttrs)
/*      */     throws ServiceException
/*      */   {
/* 1077 */     AdminConsoleCapable acc = verifyAdminConsoleCapable();
/*      */     
/*      */ 
/* 1080 */     TargetType tt = TargetType.fromCode(targetType);
/* 1081 */     Entry targetEntry = TargetType.lookupTarget(prov, tt, targetBy, target);
/*      */     
/*      */ 
/* 1084 */     GranteeType gt = GranteeType.GT_USER;
/* 1085 */     NamedEntry granteeEntry = GranteeType.lookupGrantee(prov, gt, granteeBy, grantee);
/*      */     
/* 1087 */     Account granteeAcct = (Account)granteeEntry;
/* 1088 */     RightBearer rightBearer = RightBearer.newRightBearer(granteeEntry);
/*      */     
/* 1090 */     EffectiveRights er = new EffectiveRights(targetType, TargetType.getId(targetEntry), targetEntry.getLabel(), granteeAcct.getId(), granteeAcct.getName());
/*      */     
/*      */ 
/*      */ 
/* 1094 */     acc.getEffectiveRights(rightBearer, targetEntry, expandSetAttrs, expandGetAttrs, er);
/* 1095 */     return er;
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static EffectiveRights getCreateObjectAttrs(Provisioning prov, String targetType, Key.DomainBy domainBy, String domainStr, Key.CosBy cosBy, String cosStr, GranteeSelector.GranteeBy granteeBy, String grantee)
/*      */     throws ServiceException
/*      */   {
/* 1105 */     AdminConsoleCapable acc = verifyAdminConsoleCapable();
/*      */     
/* 1107 */     TargetType tt = TargetType.fromCode(targetType);
/*      */     
/* 1109 */     String domainName = null;
/* 1110 */     if (tt == TargetType.domain) {
/* 1111 */       if (domainBy != Key.DomainBy.name) {
/* 1112 */         throw ServiceException.INVALID_REQUEST("must be by name for domain target", null);
/*      */       }
/*      */       
/* 1115 */       domainName = domainStr;
/*      */     }
/* 1117 */     Entry targetEntry = PseudoTarget.createPseudoTarget(prov, tt, domainBy, domainStr, false, cosBy, cosStr, domainName);
/*      */     
/*      */ 
/*      */ 
/* 1121 */     GranteeType gt = GranteeType.GT_USER;
/* 1122 */     NamedEntry granteeEntry = GranteeType.lookupGrantee(prov, gt, granteeBy, grantee);
/*      */     
/* 1124 */     Account granteeAcct = (Account)granteeEntry;
/* 1125 */     RightBearer rightBearer = RightBearer.newRightBearer(granteeEntry);
/*      */     
/* 1127 */     EffectiveRights er = new EffectiveRights(targetType, TargetType.getId(targetEntry), targetEntry.getLabel(), granteeAcct.getId(), granteeAcct.getName());
/*      */     
/*      */ 
/*      */ 
/* 1131 */     acc.getEffectiveRights(rightBearer, targetEntry, true, true, er);
/* 1132 */     return er;
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */   public static Grants getGrants(Provisioning prov, String targetType, TargetBy targetBy, String target, String granteeType, GranteeSelector.GranteeBy granteeBy, String grantee, boolean granteeIncludeGroupsGranteeBelongs)
/*      */     throws ServiceException
/*      */   {
/*      */     
/*      */     
/* 1142 */     if ((targetType == null) && (granteeType == null)) {
/* 1143 */       throw ServiceException.INVALID_REQUEST("at least one of target or grantee must be specified", null);
/*      */     }
/*      */     
/*      */ 
/*      */ 
/* 1148 */     TargetType tt = null;
/* 1149 */     Entry targetEntry = null;
/* 1150 */     if (targetType != null) {
/* 1151 */       tt = TargetType.fromCode(targetType);
/* 1152 */       targetEntry = TargetType.lookupTarget(prov, tt, targetBy, target);
/*      */     }
/*      */     
/*      */ 
/* 1156 */     GranteeType gt = null;
/* 1157 */     NamedEntry granteeEntry = null;
/* 1158 */     Set<String> granteeFilter = null;
/* 1159 */     Boolean isGranteeAnAdmin = null;
/* 1160 */     if (granteeType != null) {
/* 1161 */       gt = GranteeType.fromCode(granteeType);
/* 1162 */       granteeEntry = GranteeType.lookupGrantee(prov, gt, granteeBy, grantee);
/* 1163 */       isGranteeAnAdmin = Boolean.valueOf(RightBearer.isValidGranteeForAdminRights(gt, granteeEntry));
/*      */       
/* 1165 */       if (granteeIncludeGroupsGranteeBelongs) {
/* 1166 */         RightBearer.Grantee theGrantee = RightBearer.Grantee.getGrantee(granteeEntry, false);
/* 1167 */         granteeFilter = theGrantee.getIdAndGroupIds();
/*      */       } else {
/* 1169 */         granteeFilter = new HashSet();
/* 1170 */         granteeFilter.add(granteeEntry.getId());
/*      */       }
/*      */     }
/*      */     
/* 1174 */     Grants grants = new Grants();
/*      */     
/* 1176 */     if (targetEntry != null)
/*      */     {
/* 1178 */       ZimbraACL zimbraAcl = ACLUtil.getACL(targetEntry);
/*      */       
/*      */ 
/* 1181 */       grants.addGrants(tt, targetEntry, zimbraAcl, granteeFilter, isGranteeAnAdmin);
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */     }
/*      */     else
/*      */     {
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1194 */       Set<TargetType> targetTypesToSearch = new HashSet(Arrays.asList(TargetType.values()));
/*      */       
/*      */ 
/* 1197 */       SearchGrants searchGrants = new SearchGrants(prov, targetTypesToSearch, granteeFilter);
/* 1198 */       Set<SearchGrants.GrantsOnTarget> grantsOnTargets = searchGrants.doSearch().getResults();
/*      */       
/* 1200 */       for (SearchGrants.GrantsOnTarget grantsOnTarget : grantsOnTargets) {
/* 1201 */         Entry grantedOnEntry = grantsOnTarget.getTargetEntry();
/* 1202 */         ZimbraACL acl = grantsOnTarget.getAcl();
/* 1203 */         TargetType grantedOnTargetType = TargetType.getTargetType(grantedOnEntry);
/* 1204 */         grants.addGrants(grantedOnTargetType, grantedOnEntry, acl, granteeFilter, isGranteeAnAdmin);
/*      */       }
/*      */     }
/*      */     
/* 1208 */     return grants;
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   private static void validateGrant(Account authedAcct, TargetType targetType, Entry targetEntry, GranteeType granteeType, NamedEntry granteeEntry, String secret, Right right, RightModifier rightModifier, boolean revoking)
/*      */     throws ServiceException
/*      */   {
/* 1221 */     if ((!right.isUserRight()) || (RightModifier.RM_CAN_DELEGATE == rightModifier))
/*      */     {
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1229 */       if (!revoking) {
/* 1230 */         boolean isCDARight = CrossDomain.validateCrossDomainAdminGrant(right, granteeType);
/* 1231 */         if ((!isCDARight) && (!RightBearer.isValidGranteeForAdminRights(granteeType, granteeEntry)))
/*      */         {
/* 1233 */           throw ServiceException.INVALID_REQUEST("grantee for admin right or for user right with the canDelegate modifier must be a delegated admin account or admin group, it cannot be a global admin account or a regular user account.", null);
/*      */         }
/*      */       }
/*      */       
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1243 */       if (!granteeType.allowedForAdminRights()) {
/* 1244 */         throw ServiceException.INVALID_REQUEST("grantee type " + granteeType.getCode() + " is not allowed for admin right", null);
/*      */       }
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1253 */     if (!right.grantableOnTargetType(targetType)) {
/* 1254 */       throw ServiceException.INVALID_REQUEST("right " + right.getName() + " cannot be granted on a " + targetType.getCode() + " entry. " + "It can only be granted on target types: " + right.reportGrantableTargetTypes(), null);
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1264 */     if ((targetType.isGroup()) && (!CheckRight.allowGroupTarget(right))) {
/* 1265 */       throw ServiceException.INVALID_REQUEST("group target is not supported for right: " + right.getName(), null);
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1272 */     if (RightModifier.RM_SUBDOMAIN == rightModifier)
/*      */     {
/* 1274 */       if (targetType != TargetType.domain) {
/* 1275 */         throw ServiceException.INVALID_REQUEST("right modifier " + RightModifier.RM_SUBDOMAIN.getModifier() + " can only be granted on domain targets", null);
/*      */       }
/*      */       
/*      */ 
/*      */ 
/* 1280 */       if (!right.allowSubDomainModifier()) {
/* 1281 */         throw ServiceException.INVALID_REQUEST("right modifier " + RightModifier.RM_SUBDOMAIN.getModifier() + " is not allowed for the right: " + right.getName(), null);
/*      */       }
/*      */       
/*      */     }
/* 1285 */     else if (RightModifier.RM_DISINHERIT_SUB_GROUPS == rightModifier)
/*      */     {
/* 1287 */       if (targetType != TargetType.dl) {
/* 1288 */         throw ServiceException.INVALID_REQUEST("right modifier " + RightModifier.RM_DISINHERIT_SUB_GROUPS.getModifier() + " can only be granted on group targets", null);
/*      */       }
/*      */       
/*      */ 
/* 1292 */       if (!right.allowDisinheritSubGroupsModifier()) {
/* 1293 */         throw ServiceException.INVALID_REQUEST("right modifier " + RightModifier.RM_DISINHERIT_SUB_GROUPS.getModifier() + " is not allowed for the right: " + right.getName(), null);
/*      */       }
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1317 */     if (authedAcct != null) {
/* 1318 */       AccessManager am = AccessManager.getInstance();
/*      */       
/* 1320 */       if (granteeType == GranteeType.GT_EXT_GROUP)
/*      */       {
/* 1322 */         if (!AccessControlUtil.isGlobalAdmin(authedAcct)) {
/* 1323 */           throw ServiceException.PERM_DENIED("only global admins can grant to external group");
/*      */         }
/*      */       } else {
/* 1326 */         boolean canGrant = am.canPerform(authedAcct, targetEntry, right, true, null, true, null);
/* 1327 */         if (!canGrant) {
/* 1328 */           throw ServiceException.PERM_DENIED(String.format("insufficient right to %s '%s' right", new Object[] { revoking ? "revoke" : "grant", right.getName() }));
/*      */         }
/*      */         
/*      */ 
/* 1332 */         ParticallyDenied.checkPartiallyDenied(authedAcct, targetType, targetEntry, right);
/*      */       }
/*      */     }
/*      */     
/* 1336 */     if ((secret != null) && (!granteeType.allowSecret())) {
/* 1337 */       throw ServiceException.PERM_DENIED("password is not allowed for grantee type " + granteeType.getCode());
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static void verifyGrantRight(Provisioning prov, Account authedAcct, String targetType, TargetBy targetBy, String target, String granteeType, GranteeSelector.GranteeBy granteeBy, String grantee, String secret, String right, RightModifier rightModifier)
/*      */     throws ServiceException
/*      */   {
/* 1351 */     grantRightInternal(prov, authedAcct, TargetType.fromCode(targetType), targetBy, target, GranteeType.fromCode(granteeType), granteeBy, grantee, secret, right, rightModifier, true);
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static void grantRight(Provisioning prov, Account authedAcct, String targetType, TargetBy targetBy, String target, String granteeType, GranteeSelector.GranteeBy granteeBy, String grantee, String secret, String right, RightModifier rightModifier)
/*      */     throws ServiceException
/*      */   {
/* 1361 */     grantRight(prov, authedAcct, TargetType.fromCode(targetType), targetBy, target, granteeType, granteeBy, grantee, secret, right, rightModifier);
/*      */   }
/*      */   
/*      */   public static void grantRight(Provisioning prov, Account authedAcct, EffectiveRightsTargetSelector targSel, GranteeSelector granteeSel, String right, RightModifier rightModifier)
/*      */     throws ServiceException
/*      */   {
/* 1367 */     grantRightInternal(prov, authedAcct, TargetType.fromJaxb(targSel.getType()), targSel.getBy(), targSel.getValue(), GranteeType.fromJaxb(granteeSel.getType()), granteeSel.getBy(), granteeSel.getKey(), granteeSel.getSecret(), right, rightModifier, false);
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static void grantRight(Provisioning prov, Account authedAcct, TargetType targetType, TargetBy targetBy, String target, String granteeType, GranteeSelector.GranteeBy granteeBy, String grantee, String secret, String right, RightModifier rightModifier)
/*      */     throws ServiceException
/*      */   {
/* 1377 */     grantRightInternal(prov, authedAcct, targetType, targetBy, target, GranteeType.fromCode(granteeType), granteeBy, grantee, secret, right, rightModifier, false);
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   private static void grantRightInternal(Provisioning prov, Account authedAcct, TargetType tt, TargetBy targetBy, String target, GranteeType gt, GranteeSelector.GranteeBy granteeBy, String grantee, String secret, String right, RightModifier rightModifier, boolean dryRun)
/*      */     throws ServiceException
/*      */   {
/* 1388 */     verifyAccessManager();
/*      */     
/*      */ 
/* 1391 */     Entry targetEntry = TargetType.lookupTarget(prov, tt, targetBy, target);
/*      */     
/*      */ 
/* 1394 */     Right r = RightManager.getInstance().getRight(right);
/*      */     
/*      */ 
/* 1397 */     NamedEntry granteeEntry = null;
/*      */     String granteeId;
/* 1399 */     String granteeId; if (gt.isZimbraEntry()) {
/* 1400 */       granteeEntry = GranteeType.lookupGrantee(prov, gt, granteeBy, grantee);
/* 1401 */       granteeId = granteeEntry.getId(); } else { String granteeId;
/* 1402 */       if (gt == GranteeType.GT_EXT_GROUP) {
/* 1403 */         boolean asAdmin = !r.isUserRight();
/* 1404 */         ExternalGroup extGroup = ExternalGroup.get(Key.DomainBy.name, grantee, asAdmin);
/* 1405 */         if (extGroup == null) {
/* 1406 */           throw ServiceException.INVALID_REQUEST("unable to find external group " + grantee, null);
/*      */         }
/*      */         
/* 1409 */         granteeId = extGroup.getId();
/*      */ 
/*      */       }
/*      */       else
/*      */       {
/*      */ 
/* 1415 */         granteeId = grantee;
/*      */       }
/*      */     }
/* 1418 */     validateGrant(authedAcct, tt, targetEntry, gt, granteeEntry, secret, r, rightModifier, false);
/*      */     
/* 1420 */     if (dryRun) {
/* 1421 */       return;
/*      */     }
/*      */     
/* 1424 */     Set<ZimbraACE> aces = new HashSet();
/* 1425 */     ZimbraACE ace = new ZimbraACE(granteeId, gt, r, rightModifier, secret);
/* 1426 */     aces.add(ace);
/*      */     
/* 1428 */     ACLUtil.grantRight(prov, targetEntry, aces);
/*      */   }
/*      */   
/*      */   public static void revokeRight(Provisioning prov, Account authedAcct, EffectiveRightsTargetSelector targSel, GranteeSelector granteeSel, String right, RightModifier rightModifier) throws ServiceException
/*      */   {
/* 1433 */     revokeRight(prov, authedAcct, TargetType.fromJaxb(targSel.getType()), targSel.getBy(), targSel.getValue(), GranteeType.fromJaxb(granteeSel.getType()), granteeSel.getBy(), granteeSel.getKey(), right, rightModifier);
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static void revokeRight(Provisioning prov, Account authedAcct, String targetType, TargetBy targetBy, String target, String granteeType, GranteeSelector.GranteeBy granteeBy, String grantee, String right, RightModifier rightModifier)
/*      */     throws ServiceException
/*      */   {
/* 1445 */     revokeRight(prov, authedAcct, TargetType.fromCode(targetType), targetBy, target, GranteeType.fromCode(granteeType), granteeBy, grantee, right, rightModifier);
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static void revokeRight(Provisioning prov, Account authedAcct, TargetType tt, TargetBy targetBy, String target, GranteeType gt, GranteeSelector.GranteeBy granteeBy, String grantee, String right, RightModifier rightModifier)
/*      */     throws ServiceException
/*      */   {
/* 1456 */     verifyAccessManager();
/*      */     
/*      */ 
/* 1459 */     Entry targetEntry = TargetType.lookupTarget(prov, tt, targetBy, target);
/*      */     
/*      */ 
/* 1462 */     NamedEntry granteeEntry = null;
/* 1463 */     String granteeId = null;
/*      */     try {
/* 1465 */       if (gt.isZimbraEntry()) {
/* 1466 */         granteeEntry = GranteeType.lookupGrantee(prov, gt, granteeBy, grantee);
/* 1467 */         granteeId = granteeEntry.getId();
/*      */ 
/*      */       }
/*      */       else
/*      */       {
/* 1472 */         granteeId = grantee;
/*      */       }
/*      */     } catch (AccountServiceException e) {
/* 1475 */       String code = e.getCode();
/* 1476 */       if (("account.NO_SUCH_ACCOUNT".equals(code)) || ("account.NO_SUCH_DISTRIBUTION_LIST".equals(code)) || ("account.NO_SUCH_DOMAIN".equals(code)))
/*      */       {
/*      */ 
/*      */ 
/* 1480 */         ZimbraLog.acl.warn("revokeRight: no such grantee " + grantee);
/*      */         
/*      */ 
/*      */ 
/* 1484 */         if (granteeBy == GranteeSelector.GranteeBy.id) {
/* 1485 */           granteeId = grantee;
/*      */         } else {
/* 1487 */           throw ServiceException.INVALID_REQUEST("cannot find grantee by name: " + grantee + ", try revoke by grantee id if you want to remove the orphan grant", e);
/*      */         }
/*      */       } else {
/* 1490 */         throw e;
/*      */       }
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1501 */     Right r = RightManager.getInstance().getRight(right);
/*      */     
/* 1503 */     if (granteeEntry != null) {
/* 1504 */       validateGrant(authedAcct, tt, targetEntry, gt, granteeEntry, null, r, rightModifier, true);
/*      */     }
/*      */     
/* 1507 */     Set<ZimbraACE> aces = new HashSet();
/* 1508 */     ZimbraACE ace = new ZimbraACE(granteeId, gt, r, rightModifier, null);
/* 1509 */     aces.add(ace);
/*      */     
/* 1511 */     List<ZimbraACE> revoked = ACLUtil.revokeRight(prov, targetEntry, aces);
/* 1512 */     if (revoked.isEmpty()) {
/* 1513 */       throw AccountServiceException.NO_SUCH_GRANT(ace.dump(true));
/*      */     }
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */   public static void revokeAllRights(Provisioning prov, GranteeType granteeType, String granteeId)
/*      */     throws ServiceException
/*      */   {
/* 1528 */     AdminConsoleCapable acc = verifyAdminConsoleCapable();
/*      */     
/*      */ 
/*      */ 
/*      */ 
/* 1533 */     Set<TargetType> targetTypesToSearch = acc.targetTypesForGrantSearch();
/*      */     
/*      */ 
/* 1536 */     Set<String> granteeIdsToSearch = new HashSet();
/* 1537 */     granteeIdsToSearch.add(granteeId);
/*      */     
/* 1539 */     SearchGrants searchGrants = new SearchGrants(prov, targetTypesToSearch, granteeIdsToSearch);
/* 1540 */     Set<SearchGrants.GrantsOnTarget> grantsOnTargets = searchGrants.doSearch().getResults();
/*      */     
/* 1542 */     for (SearchGrants.GrantsOnTarget grantsOnTarget : grantsOnTargets) {
/* 1543 */       Entry targetEntry = grantsOnTarget.getTargetEntry();
/*      */       
/* 1545 */       Set<ZimbraACE> acesToRevoke = new HashSet();
/* 1546 */       for (ZimbraACE ace : grantsOnTarget.getAcl().getAllACEs()) {
/* 1547 */         if (granteeId.equals(ace.getGrantee())) {
/* 1548 */           acesToRevoke.add(ace);
/*      */         }
/*      */       }
/* 1551 */       ACLUtil.revokeRight(prov, targetEntry, acesToRevoke);
/*      */     }
/* 1553 */     RightBearer.Grantee.clearGranteeCache();
/*      */   }
/*      */   
/*      */   public static Element rightToXML(Element parent, Right right, boolean expandAllAtrts, Locale locale) throws ServiceException
/*      */   {
/* 1558 */     Element eRight = parent.addNonUniqueElement("right");
/* 1559 */     eRight.addAttribute("name", right.getName());
/* 1560 */     eRight.addAttribute("type", right.getRightType().name());
/* 1561 */     eRight.addAttribute("targetType", right.getTargetTypeStr());
/* 1562 */     eRight.addAttribute("rightClass", right.getRightClass().name());
/*      */     
/* 1564 */     String desc = L10nUtil.getMessage("ZsMsgRights", right.getName(), locale, new Object[0]);
/* 1565 */     if (desc == null) {
/* 1566 */       desc = right.getDesc();
/*      */     }
/*      */     
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/*      */ 
/* 1584 */     eRight.addNonUniqueElement("desc").setText(desc);
/*      */     Element eRights;
/* 1586 */     if (!right.isPresetRight()) {
/*      */       Element eAttrs;
/* 1588 */       if (right.isAttrRight()) {
/* 1589 */         eAttrs = eRight.addNonUniqueElement("attrs");
/* 1590 */         AttrRight attrRight = (AttrRight)right;
/*      */         
/* 1592 */         if (attrRight.allAttrs()) {
/* 1593 */           eAttrs.addAttribute("all", true);
/* 1594 */           if (expandAllAtrts) {
/* 1595 */             Set<String> attrs = attrRight.getAllAttrs();
/* 1596 */             for (String attr : attrs) {
/* 1597 */               if ((right.getRightType() != Right.RightType.setAttrs) || (!HardRules.isForbiddenAttr(attr))) {
/* 1598 */                 eAttrs.addNonUniqueElement("a").addAttribute("n", attr);
/*      */               }
/*      */             }
/*      */           }
/*      */         }
/*      */         else {
/* 1604 */           for (String attrName : attrRight.getAttrs()) {
/* 1605 */             eAttrs.addNonUniqueElement(attrName);
/*      */           }
/*      */         }
/* 1608 */       } else if (right.isComboRight()) {
/* 1609 */         eRights = eRight.addNonUniqueElement("rights");
/* 1610 */         ComboRight comboRight = (ComboRight)right;
/* 1611 */         for (Right r : comboRight.getRights()) {
/* 1612 */           Element eNestedRight = eRights.addNonUniqueElement("r");
/* 1613 */           eNestedRight.addAttribute("n", r.getName());
/* 1614 */           eNestedRight.addAttribute("type", r.getRightType().name());
/* 1615 */           eNestedRight.addAttribute("targetType", r.getTargetTypeStr());
/*      */         }
/*      */       }
/*      */     }
/* 1619 */     return eRight;
/*      */   }
/*      */   
/*      */ 
/*      */ 
/*      */   public static Right XMLToRight(Element eRight)
/*      */     throws ServiceException
/*      */   {
/* 1627 */     String rightName = eRight.getAttribute("name");
/* 1628 */     return RightNameToRight(rightName);
/*      */   }
/*      */   
/*      */   public static Right RightNameToRight(String rightName) throws ServiceException
/*      */   {
/* 1633 */     return RightManager.getInstance().getRight(rightName);
/*      */   }
/*      */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/accesscontrol/RightCommand.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */